An organization with a maturing incident response program conducts post-incident reviews for all major information security incidents. The PRIMARY goal of these reviews should be to:

A. identify security program gaps or systemic weaknesses that need correction.
B. prepare properly vetted notifications regarding the incidents to external parties.
C. identify who should be held accountable for the security incidents.
D. document and report the root cause of the incidents for senior management.